lib/libssh
1
0
Fork 0
mirror of https://git.libssh.org/projects/libssh.git synced 2025-11-30 13:01:23 +03:00
Code Activity

sftp: Limit packet size to 256 MB

Browse Source 
Signed-off-by: Andreas Schneider <asn@cryptomilk.org>
This commit is contained in:
Andreas Schneider
2018-09-07 21:45:35 +02:00
parent dc4faf9952
commit 38781f69b0
1 changed files with 5 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

8
src/sftp.c
View File

@@ -50,6 +50,9 @@
#ifdef WITH_SFTP #ifdef WITH_SFTP
/* Buffer size maximum is 256M */
#define SFTP_PACKET_SIZE_MAX 0x10000000
struct sftp_ext_struct { struct sftp_ext_struct {
unsigned int count; unsigned int count;
char **name; char **name;
@@ -356,7 +359,7 @@ sftp_packet sftp_packet_read(sftp_session sftp)
} while (r < 4); } while (r < 4);
size = sftp_get_u32(buffer); size = sftp_get_u32(buffer);
if (size == 0 || size > UINT32_MAX) { if (size == 0 || size > SFTP_PACKET_SIZE_MAX) {
ssh_set_error(sftp->session, SSH_FATAL, "Invalid sftp packet size!"); ssh_set_error(sftp->session, SSH_FATAL, "Invalid sftp packet size!");
goto error; goto error;
} }
@@ -384,12 +387,11 @@ sftp_packet sftp_packet_read(sftp_session sftp)
ssh_set_error_oom(sftp->session); ssh_set_error_oom(sftp->session);
goto error; goto error;
} }
while (size > 0 && size < UINT_MAX) { while (size > 0 && size < SFTP_PACKET_SIZE_MAX) {
r = ssh_channel_read(sftp->channel, r = ssh_channel_read(sftp->channel,
buffer, buffer,
sizeof(buffer) > size ? size : sizeof(buffer), sizeof(buffer) > size ? size : sizeof(buffer),
0); 0);
if (r < 0) { if (r < 0) {
/* TODO: check if there are cases where an error needs to be set here */ /* TODO: check if there are cases where an error needs to be set here */
goto error; goto error;